none
Exchange 2010 Internal Email Delayed for 5 Months RRS feed

  • Question

  • Today I got an email from a user saying she just received an internal email that was sent November 5th 2013. I tried using Exchange Tracking Log Explorer but nothing shows as being received on 11/5/13 and nothing from todays date that matches the Subject. Here are is the msg header which has been modified to hide our domain. This is a small business with 12 users with SBS 2011. This isn't the first time this has happened either. Another user had email delayed for 3 months.


    Received: from work-SERVER2.work.local ([fe90::504b:b597:b89b:e7d9]) by
    work-SERVER2.work.local ([fe90::504b:b597:b89b:e7d9%10]) with mapi id
    14.01.0438.000; Tue, 5 Nov 2013 08:38:41 -0900
    Content-Type: application/ms-tnef; name="winmail.dat"
    Content-Transfer-Encoding: binary
    From: USER NAME <sender@work.com>
    To: USERS <recipient@work.com>
    Subject: FW: INVOICE FROM ABC
    Thread-Topic: INVOICE FROM ABC
    Thread-Index: Ac7Z2hVrwb+u2RXnRA+qtd9tX4v5DAAc7eQA
    Date: Tue, 5 Nov 2013 08:38:40 -0900
    Message-ID: <BF122028D66EC74CBA777395B9BDC44201EB8BB1@work-SERVER2.work.local>
    References: <009f01ced9da$2f37ff60$8da7fe20$@com>
    In-Reply-To: <009f01ced9da$2f37ff60$8da7fe20$@com>
    Accept-Language: en-US
    Content-Language: en-US
    X-MS-Has-Attach: yes
    X-MS-Exchange-Organization-SCL: -1
    X-MS-TNEF-Correlator: <BF122028D66EC74CBA777395B9BDC44201EB8BB1@work-SERVER2.work.local>
    MIME-Version: 1.0
    X-MS-Exchange-Organization-AuthSource: work-SERVER2.work.local
    X-MS-Exchange-Organization-AuthAs: Internal
    X-MS-Exchange-Organization-AuthMechanism: 04
    X-Originating-IP: [192.168.99.99]

    Tuesday, April 1, 2014 12:43 AM

All replies

  • Hi

    First i really doubt that you would be able to see those transactions in message tracking logs since the default setting is 30 days.

    By default the message tracking log is set to 30 days, you can change that setting though through the Shell:

    http://technet.microsoft.com/en-us/library/aa997984.aspx

    If this is the case then you can better increase the tracking logs retention for 3 months for the next delay can be recorded.

    Also try to see if you could see some information on the protocol logs as well.


    Remember to mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you. Regards, Sathish

    Tuesday, April 1, 2014 3:16 AM
  • I changed the tracking logs to 150 days and hopefully we can track something next time it happens. How do I access the protocol logs?
    Tuesday, April 8, 2014 6:48 PM
  • Hi,

    Please refer to the following article to access protocol logs:
    Understanding Protocol Logging

    Protocol logging records the SMTP conversations that occur between e-mail servers as part of message delivery.These SMTP conversations occur on Send connectors and Receive connectors configured on servers running Microsoft Exchange Server 2010 that have the Hub Transport server role or the Edge Transport server role installed. You can use protocol logging to diagnose mail flow problems.By default, protocol logging is disabled on all Send connectors and Receive connectors. Protocol logging is enabled or disabled on a per-connector basis.

    Thanks.


    Niko Cheng
    TechNet Community Support

    Wednesday, April 9, 2014 1:48 AM
    Moderator
  • I enabled the Protocol logs, so I guess all we do now is wait 3 months until someone notices they never got the memo=)
    Wednesday, April 30, 2014 12:16 AM